Plex Media Server Flaws Are Being Widely Exploited: Update to 1.43.3.10861 and Check for Miners
If you run a Plex Media Server at home or for friends, please check its version today. On 19 October 2026, Plex posted an update to its security notice saying four flaws fixed in Plex Media Server 1.43.3 are “being actively and widely exploited.” A day later, on 20 October, CISA added all four to its Known Exploited Vulnerabilities catalog, which means CISA has evidence of active exploitation. I read both in full, and checked the dates in CISA’s KEV data file.
What happened
In a 1 September 2026 notice, Plex said it had recently released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to fix a number of security issues. At that time it said CVEs had been requested and details would follow.
On 19 October, Plex published those details. It says a public proof of concept was released on 16 October, and since then it has seen widespread attacks against internet facing servers that had not been updated. Plex says compromised servers have been used to run cryptocurrency miners and proxy software, which routes other people’s traffic through the victim’s internet connection.
According to SecurityWeek (19 October), the researcher behind the chain, which they call Plex2Shell, reported the bugs to Plex on 27 July, and a separate researcher’s honeypot first saw real attacks on 17 October, one day after the exploit went public.
That second part worries me more than the miner. A proxy on your home connection means strangers’ traffic leaves from your IP address, and you may never notice.
The four flaws
Plex lists them like this:
- CVE-2026-96652: unauthenticated server side request forgery in the player timeline endpoint
- CVE-2026-96654: access to internal agent functions over the loopback interface
- CVE-2026-96655: disclosure of the server owner’s admin token
- CVE-2026-96656: arbitrary file write to the Codecs directory through transcoder preferences
On their own, each sounds limited. Plex says that chained together, they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. CISA’s catalog also notes that the four can be chained. Plex says version 1.43.3.10861 and later are not affected. Watch the full build number: according to Censys’s 20 October advisory, earlier 1.43.3 builds such as 1.43.3.10828 are still vulnerable.
What CISA’s listing tells us
CISA’s data file shows all four Plex entries were added on 20 October 2026. US federal agencies have a due date of 23 October for CVE-2026-96656 and CVE-2026-96654, and 3 November for CVE-2026-96652 and CVE-2026-96655. CISA marks known ransomware use as “Unknown” for all four. Those deadlines bind only US federal agencies, but they are a good signal of how seriously to take this.
CISA’s alert and Plex’s notice do not give a severity score. Censys lists individual scores from 4.3 to 7.2, but it also says the four together are more serious than any single score suggests, so I would not read much into the numbers.
Why home servers are such easy targets
Many Plex servers live on a NAS, a spare PC or a small box in a cupboard, with remote access turned on so family can stream from anywhere. Plex itself notes that NAS package managers may not have its updated version yet, so a server can sit on an old build without the owner noticing. My day job sits close to network detection and response, and this pattern is familiar: a home service exposed to the internet, a public proof of concept, then quick, automated scanning. I wrote about a similar “trust the padlock less, check more” lesson for website owners in the ccTLD fake certificate story.
Plex’s own advice is blunt: if your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised.
Signs of compromise Plex says to look for
From Plex’s 19 October post:
- Processes started by Plex Media Server that you don’t recognise, especially names like myawesomeproxy, mylovelyminer or x12345
- Unfamiliar .so or .dll files in the Plex Codecs folder
- Outbound connections to proxystream.st
- Sustained high CPU use while nothing is playing
What to do
Update first. Open Plex Web, go to Settings, then General, and check the version. It should be 1.43.3.10861 or newer. On a NAS, if the app store has not caught up, Plex says you can download the package from its Downloads page and install it manually. Docker users should follow the instructions in Plex’s pms-docker GitHub repository.
Then check. Go through the list of signs above. Look in the Codecs folder and at your router or firewall logs for that outbound domain.
If you find anything, or can’t rule it out, Plex recommends rebuilding the server from a clean installation instead of reusing the old Plex data directory. At minimum, delete everything in the Codecs folder and check Preferences.xml for transcoder options you didn’t set. Sign out of all devices from your Plex account settings and change your Plex password. Treat anything the Plex service account could reach, such as mounted shares and credentials stored on the same machine, as potentially exposed.
Reduce exposure. If you don’t need remote access, Plex suggests turning it off under Settings, then Remote Access, and avoiding forwarding port 32400 directly unless you need it.
If a friend or relative runs the family Plex box, send them this today. Five minutes on the version screen is a lot cheaper than cleaning up after a stranger’s proxy.
Leave a comment